]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
MFC r355182: Fix use-after-free in case of L2ARC prefetch failure.
authorAlexander Motin <mav@FreeBSD.org>
Thu, 12 Dec 2019 00:29:48 +0000 (00:29 +0000)
committerAlexander Motin <mav@FreeBSD.org>
Thu, 12 Dec 2019 00:29:48 +0000 (00:29 +0000)
commit0353d439fb881233082cf327dbc9d8dd35c95f69
treed59373c4ee95b9e5239a8bd25c710e69bedf805a
parente52c70984abbf4c28226dd814484cfd4c22ec068
MFC r355182: Fix use-after-free in case of L2ARC prefetch failure.

In case L2ARC read failed, l2arc_read_done() creates _different_ ZIO
to read data from the original storage device.  Unfortunately pointer
to the failed ZIO remains in hdr->b_l1hdr.b_acb->acb_zio_head, and if
some other read try to bump the ZIO priority, it will crash.

The problem is reproducible by corrupting L2ARC content and reading
some data with prefetch if l2arc_noprefetch tunable is changed to 0.
With the default setting the issue is probably not reproducible now.
sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c